Find users of security group with django-python3-ldap

Question

Very new to LDAP and AD. I'm using django-python3-ldap to authenticate users of my django app. We want to make it so that only a subset of our users can access our django app, so yesterday they added the security group 'MyAppGroup.' Only problem is, I don't seem able to add this to the search base. User lookup always fails.

Working search base (returns ALL users):

"ou=Basic Users, ou=BIGAPP Users,dc=subd,dc=domain,dc=com"

When I asked, they said that MyAppGroup was a security group, and that "Basic Users" and "BIGAPP Users" were "AD Members."

dsquery group -name "MyAppGroup"

returns:

CN=MyAppGroup,OU=BIGAPP Groups,dc=subd,dc=domain,dc=com

This result does not work as the search base. Do I need to add a custom search filter for this to work? Any help is appreciated.

EDIT: Adding (&(memberOf=BIGAPPS Group)(memberOf=cn=MyAppGroup)) to search filters now returns "LDAP user attributes empty"

EDIT 2: Running the command dsget group "CN=MyAppGroup,OU=BIGAPP Groups,dc=subd,dc=domain,dc=com" -members -expand returns a list of group members:

"CN=User McLastname,OU=Basic Users,OU=BIGAPP Groups,dc=subd,dc=domain,dc=com" "CN=User2 o'Lastname,OU=Basic Users,OU=BIGAPP Groups,dc=subd,dc=domain,dc=com",..etc

So I know the group exists. I feel like I'm missing some small piece to make this work.

EDIT 3:

settings.py

LDAP_AUTH_URL = "ldap://sub.domain.com"
LDAP_AUTH_FORMAT_USERNAME = "django_python3_ldap.utils.format_username_active_directory"

LDAP_AUTH_USE_TLS = True

LDAP_AUTH_ACTIVE_DIRECTORY_DOMAIN = "SUBD"
LDAP_AUTH_SEARCH_BASE="DC=subd,DC=domain,DC=com"
LDAP_AUTH_OBJECT_CLASS="user"
LDAP_AUTH_USER_FIELDS = {
    "username": "sAMAccountName",
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail",
}

LDAP_AUTH_FORMAT_SEARCH_FILTERS="myapp.searchfilter.myapp_search_filters"

Search filters

def myapp_search_filters(ldap_fields):
    search_filters = format_search_filters(ldap_fields)
    search_filters.append("(&(memberOf=cn=MyAppGroup,OU=BIGAPP_Group,DC=subd,DC=domain,dc=com))")

Hmmm, I'm having trouble thinking all of this through. ous are Organizational Units, which I would think MyAppGroup would fall under. I'm not sure why they'd try restricting by a cn, which is a Common Name. — FlipperPA
– FlipperPA, Commented Nov 23, 2019 at 21:01
I wasn't using the distinguished name for the MyAppGroup in my search filter. LisaJ pointed it out, and I tried it today. Worked like a charm. — AKStrobl
– AKStrobl, Commented Nov 23, 2019 at 22:29
Thanks for popping in, I was running up against a deadline and getting twitchy :o — AKStrobl
– AKStrobl, Commented Nov 23, 2019 at 22:37

LisaJ · Accepted Answer · 2019-11-23 05:07:53Z

2

Use the fully qualified DN of the group in the memberOf filter: (&(memberOf=CN=MyAppGroup,OU=BIGAPP Groups,dc=subd,dc=domain,dc=com))

answered Nov 23, 2019 at 5:07

LisaJ

1,7211 gold badge14 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

AKStrobl Over a year ago

That solved it! Not understanding how distinguished names worked was the problem. I've posted my code up above for other people.

Collectives™ on Stack Overflow

Find users of security group with django-python3-ldap

settings.py

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

settings.py

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related